%23%23%20Le%20constat%20initial%20%3A%20le%20transport%20routier%20de%20marchandises%2C%20un%20secteur%20expos%C3%A9%20%C3%A0%20des%20risques%20de%20d%C3%A9r%C3%A9glementation%0A%0ALe%20transport%20routier%20de%20marchandises%20en%20France%20%28TRM%29%20-%2040%20000%20entreprises%2C%20400%20000%20salari%C3%A9s%20-%20%20est%20historiquement%20et%20structurellement%20expos%C3%A9%20%C3%A0%20des%20risques%20de%20d%C3%A9r%C3%A9glementation.%20En%20effet%2C%20il%20est%20%3A%20%0A%0A%2A%20r%C3%A9glement%C3%A9%20mais%20h%C3%A9t%C3%A9rog%C3%A8ne%2C%20avec%20une%20nette%20dispersion%20des%20entreprises%20%3A%20%2A%2B50%25%20de%20TPE-PME%2A.%20%20%20%0A%2A%20impact%C3%A9%20par%20une%20concurrence%20europ%C3%A9enne%20forte%20et%20d%C3%A9s%C3%A9quilibr%C3%A9e%2C%20du%20fait%20d%27une%20harmonisation%20europ%C3%A9enne%20faiblement%20effective%20%3A%20%2A45%25%20des%20transports%20int%C3%A9rieurs%20sont%20r%C3%A9alis%C3%A9s%20par%20des%20acteurs%20%C3%A9trangers%2A.%20%20%0A%2A%20marqu%C3%A9%20par%20l%27essor%20des%20V%C3%A9hicules%20Utilitaires%20L%C3%A9gers%20%28VUL%29%2C%20non%20r%C3%A9glement%C3%A9s%20%3A%20%2A20%25%20du%20transport%20int%C3%A9rieur%2A.%0A%0AL%E2%80%99apparition%20de%20nouveaux%20acteurs%20issus%20du%20num%C3%A9rique%20%28plateformes%20d%E2%80%99interm%C3%A9diation%29%2C%20hors%20du%20champ%20r%C3%A9glementaire%2C%20vient%20d%C3%A9fier%20les%20pratiques%20d%E2%80%99un%20secteur%20dont%20la%20transition%20num%C3%A9rique%20n%27est%20pas%20encore%20faite.%20%20%0A%0A%2A%2ALa%20captation%20des%20donn%C3%A9es%20professionnelles%20des%20transporteurs%20par%20les%20plateformes%20renforce%20les%20risques%20de%20d%C3%A9r%C3%A9glementation.%2A%2A%5C%0ALe%20transport%20routier%20peut%20ainsi%20subir%20une%20transformation%20du%20seul%20fait%20des%20GAFAM%2C%20qui%2C%20comme%20ils%20l%E2%80%99ont%20fait%20dans%20d%E2%80%99autres%20secteurs%2C%20imposeront%20leurs%20r%C3%A8gles%20et%20orientations%20avec%20des%20impacts%20%C3%A9conomiques%2C%20sociaux%20et%20environnementaux%20non%20ma%C3%AEtris%C3%A9s%20%28on%20reconnait%20l%C3%A0%20le%20%2Aph%C3%A9nom%C3%A8ne%20d%E2%80%99uberisation%2A%29.%0A%0AL%E2%80%99Etat%20est%20en%20mesure%20d%E2%80%99accompagner%20cette%20transformation%2C%20de%20la%20r%C3%A9glementer%20et%20la%20r%C3%A9guler%2C%20en%20cr%C3%A9ant%20une%20infrastructure%20num%C3%A9rique%20et%2C%20plus%20pr%C3%A9cis%C3%A9ment%2C%20en%20en%20impulsant%20la%20cr%C3%A9ation%20d%E2%80%99un%20%E2%80%9Ccommun%E2%80%9D%20ou%20catalogue%20de%20donn%C3%A9es%20du%20TRM%2C%20constitu%C3%A9%2C%20aliment%C3%A9%20et%20utilis%C3%A9%20par%20l%E2%80%99ensemble%20des%20%20acteurs%2C%20selon%20des%20r%C3%A8gles%20communes.%20%20%0A%0A%23%23%20La%20solution%20%3A%20A%20Dock%2C%20la%20plateforme%20num%C3%A9rique%20fer%20de%20lance%20du%20%2A%22commun%22%2A%20du%20transport%20routier%20de%20marchandises%0A%0ADepuis%20Janvier%202018%2C%20d%C3%A9velopp%C3%A9e%20par%20la%20Direction%20G%C3%A9n%C3%A9rale%20des%20Infrastructures%2C%20des%20Transports%20et%20de%20la%20Mer%20%28DGITM%29%2C%20avec%20l%E2%80%99appui%20de%20la%20Fabrique%20Num%C3%A9rique%2C%20incubateur%20du%20Minist%C3%A8re%20de%20la%20transition%20%C3%A9cologique%20et%20solidaire%2C%20%20A%20Dock%20se%20propose%20d%E2%80%99%C3%AAtre%20la%20plateforme%20permettant%20d%27impulser%20le%20%22commun%22%20du%20transport%20routier%20de%20marchandises%20%3A%0A%0A%2AEn%20valorisant%20les%20donn%C3%A9es%20d%C3%A9j%C3%A0%20d%C3%A9tenues%20par%20l%E2%80%99Etat%2A%20%28donn%C3%A9es%20Sirene%2C%20registre%20%C3%A9lectronique%20national%20des%20entreprises%20de%20transport%20par%20route%29%20%2Aou%20par%20des%20acteurs%20para-publics%2A%20%28ADEME%2C%20Programme%20Eve%29.%0A%0A%2AEn%20collectant%20de%20nouvelles%20donn%C3%A9es%20via%20une%20offre%20de%20services%20aux%20acteurs%20du%20transport%20routier%2A%20%28transporteurs%2C%20chargeurs%2C%20commissionnaires%29.%0A%0A%23%23%20L%E2%80%99offre%20de%20services%20de%20la%20plateforme%20A%20Dock%20aux%20acteurs%20du%20transport%20routier%20et%20son%20impact%20%C3%A0%20ce%20jour%0A%0A%2A%2AAssurer%20la%20visibilit%C3%A9%20en%20ligne%20des%20entreprises%20de%20transport%2A%2A%20-%20gr%C3%A2ce%20%C3%A0%20une%20fiche%20entreprise%20pr%C3%A9sentant%20leurs%20donn%C3%A9es%20professionnelles%20essentielles.%0A%0A%2A%20100%20%25%20des%20entreprises%20en%20France%20sont%20r%C3%A9f%C3%A9renc%C3%A9es%0A%2A%2030%20donn%C3%A9es%20sont%20d%C3%A9j%C3%A0%20disponibles%20par%20fiche%20entreprise%0A%2A%20200%20000%20consultations%20de%20fiches%20entreprises%20recens%C3%A9es%0A%0A%2A%2AAssurer%20un%20acc%C3%A8s%20gratuit%20aux%20donn%C3%A9es%20des%20transporteurs%2A%2A%20-%20gr%C3%A2ce%20%C3%A0%20un%20moteur%20de%20recherche%20ouvert%20et%20gratuit%20pour%20tous%20les%20commanditaires%20du%20transport%20routier.%0A%0A%2A%2040%E2%80%AF000%20fiches%20entreprises%20en%20consultation%20libre%0A%2A%201000%20fiches%20entreprises%20compl%C3%A9t%C3%A9es%0A%2A%208%E2%80%AF000%20attestations%20t%C3%A9l%C3%A9charg%C3%A9es%0A%0A%2A%2ASimplifier%20la%20gestion%20administrative%20des%20entreprises%2A%2A%20-%20gr%C3%A2ce%20%C3%A0%20la%20d%C3%A9mat%C3%A9rialisation%20de%20d%C3%A9marches%20essentielles%20aux%20entreprises%20de%20transport.%0A%0A%2A%204%20d%C3%A9marches%20disponibles%0A%2A%20%2A%20%2Aen%20France%20enti%C3%A8re%2A%20%3A%20attestation%20d%E2%80%99emploi%20ou%20de%20non%20emploi%20de%20travailleurs%20soumis%20%C3%A0%20autorisation%20de%20travail.%0A%2A%20%2A%20%2Aen%20r%C3%A9gion%20Bretagne%2A%20%3A%20renouvellement%20des%20licences%20de%20transport%20%3B%20demande%20de%20copies%20de%20licences%20suppl%C3%A9mentaires%20%3B%20demande%20d%E2%80%99acc%C3%A8s%20%C3%A0%20la%20profession%20de%20transporteur%20routier%20de%20marchandises.%0A%2A%20350%20d%C3%A9marches%20r%C3%A9alis%C3%A9es%0A%2A%2055%20minutes%20gagn%C3%A9es%20par%20d%C3%A9marche%20r%C3%A9alis%C3%A9e%20soit%20plus%20de%20300%20heures%20cumul%C3%A9es.%0A%0ANos%20derni%C3%A8res%20statistiques%20%3A%20https%3A%2F%2Fadock.beta.gouv.fr%2Fstats%0A%0A%23%23%20La%20vision%20pour%20la%20plateforme%20%3A%20A%20Dock%2C%20le%20point%20d%E2%80%99acc%C3%A8s%20unique%20aux%20donn%C3%A9es%20et%20d%C3%A9marches%20du%20transport%20routier%20de%20marchandises%0A%0AA%20Dock%20ambitionne%20d%E2%80%99%C3%AAtre%20le%20point%20d%E2%80%99acc%C3%A8s%20public%20national%20vers%20l%E2%80%99ensemble%20des%20donn%C3%A9es%20%28%2Acommun%20du%20TRM%2A%29%20et%20des%20d%C3%A9marches%20administratives%20essentielles%20du%20secteur.%0A%C3%80%20cet%20%C3%A9gard%2C%20le%20service%20est%20d%C3%A9velopp%C3%A9%20en%20collaboration%20avec%20ses%20utilisateurs%20cibles%20%28transporteurs%20routiers%2C%20chargeurs%2C%20commissionnaires%29%2C%20leurs%20organisations%20professionnelles%2C%20ainsi%20que%20les%20administrations%20centrales%20ou%20r%C3%A9gionales%20comp%C3%A9tentes%20%28DREAL%29%2C%20afin%20d%27%C3%AAtre%20au%20plus%20pr%C3%A8s%20de%20leurs%20attentes%20et%20besoins.%0A%0A%C3%80%20%20noter%20%3A%20A%20Dock%20n%E2%80%98a%20pas%20vocation%20%C3%A0%20intervenir%20sur%20les%20aspects%20contractuels%20ou%20commerciaux%20des%20relations%20transporteurs-commanditaires.%0A%0A%23%23%20Fin%20du%20partenariat%20avec%20la%20DGITM%0A%0AEn%20novembre%202020%2C%20la%20DGITM%20d%C3%A9cide%20d%27arr%C3%AAter%20les%20financements%20du%20service%20A-Dock.%20Le%20service%20pourrait%20%C3%AAtre%20r%C3%A9utilis%C3%A9%20%C3%A0%20d%27autres%20fins%20en%202021%20notamment%20pour%20faciliter%20la%20mise%20en%20oeuvre%20du%20%5BPaquet%20mobilit%C3%A9%5D%28https%3A%2F%2Fwww.europarl.europa.eu%2Fnews%2Ffr%2Fpress-room%2F20200120IPR70630%2Fpaquet-mobilite-soutien-a-l-accord-conclu-avec-les-ministres-de-l-ue%29%20europ%C3%A9en.%20%0A%0A

A Dock

investigation

construction

acceleration

alumni

content-security-policy

Content Security Policy (CSP) implemented with unsafe sources inside style-src. This includes 'unsafe-inline', data: or overly broad sources such as https:.

contribute

Contribute.json isn't required on websites that don't belong to Mozilla

cookies

cross-origin-resource-sharing

Content is not visible via cross-origin resource sharing (CORS) files or headers

public-key-pinning

HTTP Public Key Pinning (HPKP) header not implemented

redirection

Initial redirection is to HTTPS on same host, final destination is HTTPS

referrer-policy

strict-transport-security

HTTP Strict Transport Security (HSTS) header set to a minimum of six months (15768000)

subresource-integrity

Subresource Integrity (SRI) not implemented, but all scripts are loaded from a similar origin

x-content-type-options

X-Content-Type-Options header set to "nosniff"

x-frame-options

X-Frame-Options (XFO) implemented via the CSP frame-ancestors directive

x-xss-protection

X-XSS-Protection header set to "1; mode=block"

default-src 'self' *.gouv.fr; report-uri https://o59236.ingest.sentry.io/api/1187894/envelope/;  connect-src 'self' https://o59236.ingest.sentry.io/ https://api-adresse.data.gouv.fr/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; font-src 'self' https://fonts.gstatic.com/ themes.googleusercontent.com data:; script-src 'self' https://stats.data.gouv.fr/; frame-ancestors 'none'; form-action 'self'; base-uri 'self'; img-src 'self' https: data:

Diagnostics

Metrics

http

A CAA record was discovered. A CAA record is used to specify which certificate authorities (CAs) are allowed to issue certificates for a domain.

CAA Record

Setting the XSS-Protection header is deprecated. Setting the header to anything other than `0` can actually introduce an XSS vulnerability.

XSS-Protection Header - Cross-Site Scripting

Wappalyzer Technology Detection

This template searches for missing HTTP security headers. The impact of these missing headers can vary.


HTTP Missing Security Headers

WAF Detection

OpenSSH Service - Detect

Generic C2 JARM - Detect

Extract the issuer's organization from the target's certificate. Issuers are entities which sign and distribute certificates.


Detect SSL Certificate Issuer

Extract the Subject Alternative Name (SAN) from the target's certificate. SAN facilitates the usage of additional hostnames with the same certificate.


SSL DNS Names

TLS version detection is a security process used to determine the version of the Transport Layer Security (TLS) protocol used by a computer or server.
It is important to detect the TLS version in order to ensure secure communication between two computers or servers.


TLS Version - Detect

_pk_ses.50.ea54

_pk_id.50.ea54

TYPO3 is a free and open-source Web content management system written in PHP.

TYPO3 CMS

Sentry is an open-source platform for workflow productivity, aggregating errors from across the stack in real time.

Sentry

PHP is a general-purpose scripting language used for web development.

Vuetify is a reusable semantic component framework for Vue.js that aims to provide clean, semantic and reusable components.

Vuetify

Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.

Vue.js

Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.

Nginx

Matomo Analytics is a free and open-source web analytics application, that runs on a PHP/MySQL web-server.

Matomo Analytics

core-js is a modular standard library for JavaScript, with polyfills for cutting-edge ECMAScript features.

core-js

HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.

HSTS

Webpack is an open-source JavaScript module bundler.

Webpack

CSP: Wildcard Directive

CSP: style-src unsafe-inline

CSP: Notices

Dangerous JS Functions

Permissions Policy Header Not Set

Timestamp Disclosure - Unix

Base64 Disclosure

Information Disclosure - Suspicious Comments

Modern Web Application

Re-examine Cache-control Directives

Sec-Fetch-Dest Header is Missing

Sec-Fetch-Mode Header is Missing

Sec-Fetch-Site Header is Missing

Sec-Fetch-User Header is Missing

Storable and Cacheable Content

Un%20r%C3%A9sum%C3%A9%20%282%20min%20de%20lecture%29%0A%0A%23%201%2C43%20personnes%20par%20v%C3%A9hicule%20seulement%20dans%20les%20d%C3%A9placements%20%22courte%20distance%22%0A%0ALe%20d%C3%A9veloppement%20du%20covoiturage%20courte%20distance%20n%E2%80%99a%20pas%20connu%20le%20m%C3%AAme%20essor%20que%20son%20homologue%20sur%20longue%20distance.%20Que%20ce%20soit%20des%20op%C3%A9rateurs%20priv%C3%A9s%20ou%20des%20plateformes%20de%20covoiturage%20publiques%2C%20le%20constat%20est%20identique.%20Le%20paysage%20du%20covoiturage%20courte%20distance%20fran%C3%A7ais%20se%20retrouve%20ainsi%20morcel%C3%A9.%20%0APourtant%2C%20c%E2%80%99est%20une%20question%20d%E2%80%99int%C3%A9r%C3%AAt%20g%C3%A9n%C3%A9ral%20que%20ce%20secteur%20se%20d%C3%A9veloppe%20pour%20r%C3%A9pondre%20aux%203%20grands%20enjeux%20suivants%20%3A%20%0A%2A%20enjeux%20environnementaux%20%3A%20le%20secteur%20des%20transports%20repr%C3%A9sente%2029%25%20des%20%C3%A9missions%20totales%20de%20GES%20de%20la%20France.%20La%20voiture%20particuli%C3%A8re%20est%20responsable%20%C3%A0%20elle%20seule%20de%20plus%20de%2015%20%25%20%20des%20%C3%A9missions%20de%20GES%20totales%20%28source%20%3A%20CITEPA%2C%202020%29%20%C3%80%20titre%20d%E2%80%99exemple%2C%20en%20covoiturant%20quotidiennement%20un%20fran%C3%A7ais%20permet%20d%E2%80%99%C3%A9viter%20l%E2%80%99%C3%A9mission%20de%203TCO2%20eq%20par%20an%20et%20peut%20ainsi%20r%C3%A9duire%20son%20empreinte%20carbone%20de%20pr%C3%A8s%20de%2012%25.%0A%2A%20enjeux%20%C3%A9conomiques%20et%20sociaux%20%3A%20en%20France%2C%20selon%20le%20Barom%C3%A8tre%20des%20mobilit%C3%A9s%20au%20quotidien%20%28Wimoov%20FNH%20-%202022%29%20plus%20de%2013%20millions%20de%20fran%C3%A7ais%20se%20trouvent%20en%20situation%20de%20%22pr%C3%A9carit%C3%A9%20mobilit%C3%A9%22%20par%20manque%20de%20moyens%20financiers%20ou%20techniques.%20Pour%20ces%20publics%2C%20le%20covoiturage%20repr%C3%A9sente%20une%20r%C3%A9elle%20alternative%20%C3%A9conomique%20et%20sociale%20pour%20se%20d%C3%A9placer.%0A%2A%20enjeux%20sanitaires%20%28qualit%C3%A9%20de%20l%27air%29%20%3A%2048%20000%20d%C3%A9c%C3%A8s%20pr%C3%A9matur%C3%A9s%20par%20an%20sont%20caus%C3%A9%20par%20la%20pollution%20de%20l%E2%80%99air%20ext%C3%A9rieur%20soit%209%25%20de%20la%20mortalit%C3%A9%20en%20France%20%28source%20%3A%20sant%C3%A9%20publique%20France%29.%20Une%20part%20importante%20de%20cette%20pollution%20r%C3%A9sulte%20du%20dioxyde%20d%E2%80%99azote%20et%20des%20particules%20fines%20g%C3%A9n%C3%A9r%C3%A9es%20par%20les%20v%C3%A9hicules.%20%0A%0ALe%20probl%C3%A8me%20%3A%20%0ALe%20manque%20d%E2%80%99outils%20et%20d%E2%80%99accompagnement%20des%20territoires%20face%20%C3%A0%20ce%20probl%C3%A8me%20entrave%20la%20mise%20en%20place%20de%20politiques%20publiques%20ambitieuses%20et%20donc%20la%20massification%20du%20covoiturage%20quotidien.%0A%0A%0ALa%20solution%20%3A%20%0ACovoiturage.gouv%20accompagne%20et%20amplifie%20le%20d%C3%A9ploiement%20des%20politiques%20publiques%20locales%20ou%20nationales%20en%20faveur%20du%20covoiturage%20quotidien.%0AAutour%20d%27un%20registre%20de%20preuve%20aggr%C3%A9geant%20la%20quasi%20totalit%C3%A9%20des%20trajets%20normalis%C3%A9s%20et%20qualifi%C3%A9s%20provenant%20des%20plateformes%20de%20covoiturage%20quotidien%20interm%C3%A9di%C3%A9%2C%20des%20services%20connexes%20sont%20d%C3%A9ploy%C3%A9s%20pour%20%3A%20sensibiliser%20l%27%C3%A9cosyst%C3%A8me%20aux%20diff%C3%A9rentes%20politiques%20publiques%20%C3%A0%20travers%20des%20webinaires%20et%20un%20observatoire%20national%20%3B%20renforcer%20les%20liens%20de%20confience%20entre%20acteurs%20publics%20et%20priv%C3%A9s%20en%20accompagnant%20la%20lutte%20contre%20la%20fraude%3B%20et%20en%20facilitant%20la%20mise%20en%20place%20des%20dispositifs%20d%27aide%20au%20d%C3%A9veloppement%20de%20la%20pratique%20%3A%20campagnes%20d%27incitations%20financi%C3%A8res%2C%20forfait%20mobilit%C3%A9%20durable%2C%20fond%20vert%20et%20prime%20CEE.%0A%0AL%E2%80%99impact%20%3A%0ALe%20principal%20indicateur%20de%20succ%C3%A8s%20de%20la%20SE%20est%20le%20volume%20de%20covoiturages%20du%20quotidien%20trait%C3%A9s%20et%20enregistr%C3%A9s%20comme%20valides%20dans%20notre%20registre%20de%20preuve%20de%20covoiturage%2C%20nous%20vison%201million%20de%20trajets%20mensuel%20%C3%A0%20fin%202023.%20Nos%20indicateurs%20secondaires%20sont%20la%20volum%C3%A9trie%20de%20trajets%20invalid%C3%A9s%20ainsi%20que%20l%27%C3%A9volution%20de%20l%27usage%20sur%20chaque%20de%20nos%20services%20connexes.%20%5BEn%20savoir%20plus%2C%20voir%20la%20page%20de%20statistiques%20du%20Registre%20de%20preuve%20de%20covoiturage%5D%28https%3A%2F%2Fstats.covoiturage.beta.gouv.fr%2Fembed%2Fdashboard%2F3bec1692-1456-41c2-95a9-6606af329df9%29%20%0A%0A

Registre de preuve de covoiturage

Content Security Policy (CSP) implemented with default-src 'none' and no 'unsafe'

Content is visible via cross-origin resource sharing (CORS) files or headers, but is restricted to specific domains

Referrer-Policy header set to "no-referrer", "same-origin", "strict-origin" or "strict-origin-when-cross-origin"

Subresource Integrity (SRI) is not needed since site contains no script tags

X-Frame-Options (XFO) header set to SAMEORIGIN or DENY

X-XSS-Protection header not needed due to strong Content Security Policy (CSP) header

File similar to robots.txt but intended to be read by humans wishing to contact a website’s owner about security issues. Often defines a security policy and contact details.


security.txt File

Content Security Policy (CSP) header not implemented

X-Content-Type-Options header not implemented

X-Frame-Options (XFO) header not implemented

Detect websites using AWS bucket storage

FingerprintHub Technology Fingerprint tests run in nuclei.

FingerprintHub Technology Fingerprint

Detect if AWS is being used in the application.

AWS Service - Detect

Detect Amazon-S3 Bucket

TypeScript is an open-source language which builds on JavaScript  by adding static type definitions.

TypeScript

Zone.js

Angular is a TypeScript-based open-source web application framework led by the Angular Team at Google.

Angular

Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.

Amazon Web Services

Moment.js is a free and open-source JavaScript library that removes the need to use the native JavaScript Date object directly.

Moment.js

Module Federation is a webpack technology for dynamically loading parts of other independently deployed builds.

Module Federation

Content Security Policy (CSP) Header Not Set

Missing Anti-clickjacking Header

Sub Resource Integrity Attribute Missing

X-Content-Type-Options Header Missing

HTaccess config file

Progressive Web Apps (PWAs) are web apps built and enhanced with modern APIs to deliver enhanced capabilities, reliability, and installability while reaching anyone, anywhere, on any device, all with a single codebase.

Open Graph is a protocol that is used to integrate any web page into the social graph.

Open Graph

An MX record was detected. MX records direct emails to a mail exchange server.

MX Record Detection

DNS DMARC - Detect

An NS record was detected. An NS record delegates a subdomain to a set of name servers.

NS Record Detection

A DNS TXT record was detected. The TXT record lets a domain admin leave notes on a DNS server.

DNS TXT Record Detected

EventListener contains a cross-site scripting vulnerability via the document object model (DOM). An attacker can execute arbitrary script which can then allow theft of cookie-based authentication credentials and launch of  other attacks.

DOM EventListener - Cross-Site Scripting

Generic CMS Detection using html meta generator tag

Metatag CMS Detection

Hugo is an open-source static site generator written in Go.

Hugo

Sendinblue is an email marketing solution for small and medium-sized businesses that want to send and automate email marketing campaigns.

Sendinblue

Mailjet is an email delivery service for marketing and developer teams.

Mailjet

Absence of Anti-CSRF Tokens

Vulnerable JS Library

Cross-Domain JavaScript Source File Inclusion

Information Disclosure - Sensitive Information in URL

Non-Storable Content

DiaLog%0A%0A%23%23%20Le%20probl%C3%A8me%20%0A%0AAujourd%E2%80%99hui%2C%20les%20chauffeurs%20de%20poids%20lourds%20sont%20quotidiennement%20confront%C3%A9s%20%C3%A0%20des%20difficult%C3%A9s%20dans%20la%20planification%20de%20leurs%20trajets.%20%2A%2APour%20les%20poids%20lourds%2C%20conna%C3%AEtre%20leurs%20conditions%20de%20circulation%20ou%20de%20stationnement%20est%20difficile.%2A%2A%0A%0APourtant%2C%20ces%20r%C3%A9glementations%20de%20circulation%20sont%20primordiales%20pour%20%3A%0A%0A-%20%2A%2ALa%20bonne%20circulation%20des%20poids%20lourds%2A%2A%20%28v%C3%A9hicules%20de%20secours%2C%20approvisionnement%20de%20marchandises%E2%80%A6%29.%0A-%20%2A%2ALa%20s%C3%A9curit%C3%A9%20du%20public%2A%2A%20et%20%2A%2Ala%20pr%C3%A9servation%20des%20infrastructures%20routi%C3%A8re.%2A%2A%0A%0APour%20tenter%20de%20r%C3%A9soudre%20ce%20probl%C3%A8me%2C%20%2A%2ADialog%20permet%20aux%20administrations%20de%20num%C3%A9riser%20ces%20r%C3%A8gles.%2A%2A%20La%20r%C3%A9glementation%20peut%20ainsi%20%C3%AAtre%20diffus%C3%A9e%20aux%20%2Aservices%20de%20calculs%20d%E2%80%99itin%C3%A9raires%2A%20%28GPS%29.%0A%0A%23%23%20La%20solution%0A%0ADialog%20est%20une%20plateforme%20pour%20les%20administrations.%20Elles%20peuvent%20y%20%2A%2Anum%C3%A9riser%20la%20r%C3%A9glementation%20des%20poids%20lourds%2A%2A%20%28circulation%2C%20stationnement%E2%80%A6%29.%0A%0A%2A%2ALes%20donn%C3%A9es%20sont%20ensuite%20accessibles%20aux%20GPS%2A%2A%2C%20sur%20le%20principe%20de%20l%E2%80%99Open%20Data.%20Les%20GPS%20sont%20en%20charge%20de%20les%20int%C3%A9grer%20dans%20leurs%20calculateurs%20d%E2%80%99itin%C3%A9raires.%0A%0ALes%20donn%C3%A9es%20peuvent%20aussi%20%C3%AAtre%20communiqu%C3%A9es%20%2A%2Adirectement%20aux%20acteurs%20de%20la%20logistique%20et%20des%20services%20d%E2%80%99urgence%2A%2A%2C%20dans%20des%20formats%20adapt%C3%A9s%20%C3%A0%20leurs%20besoins.%0A%0APour%20vous%20rendre%20sur%20le%20site%20beta%2C%20c%27est%20ici%20%3A%20https%3A%2F%2Fdialog.beta.gouv.fr%2F%0A%0A%23%23%20Impact%0A%0ADiaLog%20est%20en%20%2A%2Aphase%20de%20construction%2A%2A%20et%20de%20test%20aupr%C3%A8s%20de%20deux%20collectivit%C3%A9s%20%3A%20Rennes%20et%20Savenay%20%289000%20habitants%29.%0A%0AUne%20premi%C3%A8re%20version%20sera%20%2A%2Amise%20en%20production%20pour%20mars%202023%2A%2A.%20Cette%20version%20se%20concentrera%20sur%20les%20r%C3%A9glementations%20%2A%2Atravaux%20et%20poids%20lourds%2A%2A.%0A%0ACourant%202023%2C%20nous%20visons%20le%20d%C3%A9ploiement%20%3A%0A%0A-%20En%20Ile-de-France%20ainsi%20que%20dans%20au%20moins%205%20territoires%20hors%20IDF.%0A-%20Dans%20au%20moins%20un%20service%20de%20navigation%20par%20GPS.%0A%0AL%E2%80%99objectif%20%C3%A0%20terme%20sera%20de%20prendre%20en%20charge%20l%E2%80%99ensemble%20des%20r%C3%A8gles%20de%20circulation%20et%20de%20stationnement%20s%E2%80%99appliquant%20aux%20poids%20lourds.%0A%0AL%E2%80%99impact%20sera%20double%20%3A%0A%0A-%20Pour%20les%20%2A%2Achauffeurs%20poids%20lourds%2A%2A%20%3A%20des%20meilleures%20conditions%20de%20travail%20gr%C3%A2ce%20%C3%A0%20une%20circulation%20fluidifi%C3%A9e%20et%20moins%20de%20situations%20bloquantes.%0A-%20Pour%20les%20%2A%2Acollectivit%C3%A9s%2A%2A%20%3A%20une%20circulation%20plus%20fluide%20et%20plus%20s%C3%A9curis%C3%A9e%0A

DiaLog

Content Security Policy (CSP) implemented without 'unsafe-inline' or 'unsafe-eval'

HTTP Strict Transport Security (HSTS) header cannot be recognized

default-src 'self'; block-all-mixed-content; img-src 'self' data:; script-src 'self' 'unsafe-inline' 'nonce-UsM74ZdVM0JWXn5u/6r+og=='; style-src 'self' 'unsafe-inline' 'nonce-UsM74ZdVM0JWXn5u/6r+og=='

https

robots.txt endpoint prober

default-src 'self'; block-all-mixed-content; img-src 'self' data:; script-src 'self' 'unsafe-inline' 'nonce-9y5ni+LmiTFBl5hYDBiCPQ=='; style-src 'self' 'unsafe-inline' 'nonce-9y5ni+LmiTFBl5hYDBiCPQ=='

Turbo is a JavaScript framework for building fast web applications.

Turbo

Big Redirect Detected (Potential Sensitive Information Leak)

Strict-Transport-Security Multiple Header Entries (Non-compliant with Spec)

Authentication Request Identified

CSP: X-Content-Security-Policy

Obsolete Content Security Policy (CSP) Header Found

Session Management Response Identified

Content Security Policy (CSP) implemented unsafely. This includes 'unsafe-inline' or data: inside script-src, overly broad sources such as https: inside object-src or script-src, or not restricting the sources for object-src or script-src.

Referrer-Policy header set to "no-referrer-when-downgrade"

Subresource Integrity (SRI) not implemented, but all external scripts are loaded over HTTPS

frame-ancestors https:; default-src 'self' app.gitbook.com api.gitbook.com integrations.gitbook.com files.gitbook.com *.gitbook.com; connect-src 'self' blob: * app.gitbook.com api.gitbook.com *.intercom.io wss://*.intercom.io uploads.intercomcdn.com uploads.intercomusercontent.com sentry.io *.sentry.io www.google-analytics.com stats.g.doubleclick.net ampcid.google.com analytics.google.com about: www.googletagmanager.com translate.googleapis.com translate.google.com www.gstatic.com https://*.algolia.net https://*.algolianet.com *.iframe.ly cdnjs.cloudflare.com cdn.jsdelivr.net *.amplitude.com cloudflareinsights.com *.googleapis.com *.cloudfunctions.net *.google.com *.firebaseio.com wss://*.firebaseio.com; manifest-src 'self'; script-src 'self' 'unsafe-eval' integrations.gitbook.com app.gitbook.com https://js.intercomcdn.com https://widget.intercom.io https://app.intercom.io https://browser.sentry-cdn.com https://js.sentry-cdn.com https://*.sentry.io https://sentry.io https://www.google-analytics.com https://ssl.google-analytics.com https://google-analytics.com https://www.googletagmanager.com https://googletagmanager.com https://translate.googleapis.com https://translate.google.com https://*.algolia.net https://*.algolianet.com https://cdn.iframe.ly https://cdnjs.cloudflare.com https://cdn.jsdelivr.net https://unpkg.com https://cdn.polyfill.io https://cdn.amplitude.com https://static.cloudflareinsights.com 'unsafe-inline' *.firebaseio.com *.gstatic.com *.google.com; style-src 'self' 'unsafe-inline' app.gitbook.com translate.googleapis.com cdnjs.cloudflare.com cdn.jsdelivr.net unpkg.com; img-src data: * blob: static.intercomassets.com *.intercomcdn.com *.intercom-mail.com *.intercom.io *.intercomusercontent.com *.intercom-attachments-1.com *.intercom-attachments-2.com *.intercom-attachments-3.com *.intercom-attachments-5.com *.intercom-attachments-6.com *.intercom-attachments-7.com *.intercom-attachments-9.com www.google-analytics.com ssl.google-analytics.com www.google.com analytics.google.com www.googletagmanager.com translate.google.com translate.googleapis.com www.gstatic.com cdnjs.cloudflare.com cdn.jsdelivr.net unpkg.com; font-src app.gitbook.com * js.intercomcdn.com fonts.intercomcdn.com data: cdnjs.cloudflare.com cdn.jsdelivr.net unpkg.com; child-src 'self' blob: www.intercom-reporting.com intercom-sheets.com www.youtube.com player.vimeo.com fast.wistia.net www.googletagmanager.com; worker-src 'self' blob:; frame-src www.intercom-reporting.com www.googletagmanager.com *; form-action api-iam.intercom.io intercom.help; media-src *.intercomcdn.com;

DNS SaaS Service Detection

GitBook is a command-line tool for creating documentation using Git and Markdown.

GitBook

Algolia offers a hosted web search product delivering real-time results.

Algolia

Firebase is a Google-backed application development software that enables developers to develop iOS, Android and Web apps.

Firebase

Google Cloud is a suite of cloud computing services.

Google Cloud

Polyfill is a service which accepts a request for a set of browser features and returns only the polyfills that are needed by the requesting browser.

Polyfill

Segment is a customer data platform (CDP) that helps you collect, clean, and control your customer data.

Segment

Amplitude is a web and mobile analytics solution with cross-platform user journey tracking, user behavior analysis and segmentation capabilities.

Amplitude

reCAPTCHA is a free service from Google that helps protect websites from spam and abuse.

reCAPTCHA

Google Cloud Trace is a distributed tracing system that collects latency data from applications and displays it in the Google Cloud Console.

Google Cloud Trace

Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.

Cloudflare

Prism is an extensible syntax highlighter.

Prism

HTTP/3 is the third major version of the Hypertext Transfer Protocol used to exchange information on the World Wide Web.

HTTP/3

PII Disclosure

CSP: script-src unsafe-eval

CSP: script-src unsafe-inline

Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s)

Strict-Transport-Security Header Not Set

Retrieved from Cache

le.taxi%2C%20c%27est%20plus%20de%2060%C2%A0000%20chauffeurs%20en%20France%2C%20m%C3%A9tropolitaine%20et%20Outre-Mer%2C%20partout%20sur%20le%20territoire%2C%20de%20la%20plus%20petite%20commune%20%C3%A0%20la%20plus%20grande%20m%C3%A9tropole%20que%20l%27on%20peut%20solliciter%20pour%20une%20course%20imm%C3%A9diate%20%C3%A0%20l%27aide%20de%20son%20smartphone.%0A%0ADisponibilit%C3%A9%0A-------------%0A%0Ale.taxi%20c%27est%20la%20garantie%20de%20commander%20imm%C3%A9diatement%20un%20taxi%20disponible%20%28lumineux%20au%20vert%29%20au%20plus%20pr%C3%A8s%2C%20quel%20que%20soit%20le%20lieu%2C%20le%20jour%20ou%20l%27heure.%20L%27api%20le.taxi%20est%20aujourd%27hui%20connect%C3%A9e%20%C3%A0%20plus%20d%27une%20dizaine%20d%27applications%20qui%20permettent%20aux%20usagers%20de%20solliciter%20un%20taxi%20d%27une%20part%2C%20et%20aux%20chauffeurs%20taxis%20de%20r%C3%A9pondre%20%C3%A0%20la%20demande%20de%20ces%20usagers.%20Les%20chauffeurs%20taxis%20utilisent%20pour%20cela%20des%20applications%20chauffeurs%2C%20list%C3%A9es%20sur%20https%3A%2F%2Fle.taxi%2Fpartners%20afin%20de%20recevoir%20des%20demandes%20de%20courses%20imm%C3%A9diates.%20Quant%20aux%20personnes%20%C3%A0%20la%20recherche%20d%27un%20taxi%2C%20elles%20sont%20invit%C3%A9es%20%C3%A0%20utiliser%20une%20application%20client%20parmi%20celles%20figurant%20sur%20https%3A%2F%2Fle.taxi%2Fpartners.%0A%0A%0AQualit%C3%A9%0A-------%0A%0Ale.taxi%2C%20c%27est%20une%20exigence%20de%20qualit%C3%A9%20renforc%C3%A9e%2C%20pour%20r%C3%A9pondre%20aux%20besoins%20des%20usagers.%0A%0A%0AS%C3%A9curit%C3%A9%0A--------%0A%0Ale.taxi%20c%27est%20la%20garantie%20d%27un%20chauffeur%20professionnel%20et%20d%27applications%20agr%C3%A9%C3%A9es%20respectueuses%20de%20la%20vie%20priv%C3%A9e.%0A%0AChaque%20chauffeur%20taxi%20est%20tenu%20de%20renseigner%20un%20certain%20nombre%20d%27informations%20pour%20avoir%20la%20capacit%C3%A9%20de%20r%C3%A9pondre%20aux%20demandes%20de%20courses%20imm%C3%A9diates.%0A

URL (11)	Phase	Déclaration d'accessibilité	Code ouvert	Mentions légales	Politique de confidentialité	DSFR	Eco-index	Tests auto accessibilité	Performance	SEO	SSL	HTTP	Disponibilité	Apdex	Vulnérabilités	CodeScan	Nmap	Ports ouverts	Trackers	Cookies	Stats	Budget	404	SonarCloud
adock.beta.gouv.fr
api.covoiturage.beta.gouv.fr
app.covoiturage.beta.gouv.fr
attestation.covoiturage.beta.gouv.fr
covoiturage.beta.gouv.fr
dialog.beta.gouv.fr
doc.covoiturage.beta.gouv.fr
le.taxi
mobilic.beta.gouv.fr
tech.covoiturage.beta.gouv.fr
transport.data.gouv.fr